Security Policy

Defines security controls protecting WEBSPACEAI systems, infrastructure, and customer data.

All infrastructure, employees, contractors, vendors.

Security Incident.

• Encryption: TLS 1.2+ in transit; AES-256 at rest.
• Authentication: MFA mandatory for employees/admins; SSO/SAML for enterprise.
• Access Control: RBAC, least privilege.
• Logging & Monitoring: Centralized, 24/7 automated. [FIX] Audit logs for agentic and administrative actions are now cryptographically signed (hash-chained) to ensure tamper-evidence, per the Autonomous Agent Policy enforcement upgrade.
• Incident Response: Documented IR plan with executive escalation.
• Infrastructure Security: Hardened, segmented, regularly pen-tested. [FIX] Mandatory penetration testing cadence increased to quarterly for agentic-feature infrastructure (WSAI CODE execution environments), semi-annual for other infrastructure.
• Vendor Security: Pre-onboarding assessments.
• Employee Security: Background checks, training, device management.
• Data Protection: Classification-based protection tiers.
• Business Continuity: Annual DR testing with defined RTO/RPO.

CISO owns this policy; all employees complete annual security training.

Aligned with SOC 2, ISO 27001, and ISO 42001 (AI management systems).

Access revocation and disciplinary action for violations.

security@webspaceai.in

CISO written approval with compensating controls.

Every 6 months and after major incidents.

security@webspaceai.in | https://webspaceai.in/security